Example Usage

sudo docker build -t splunk4dfir .
sudo docker run --name splunk4dfir -e SPLUNK_START_ARGS=--accept-license -e SPLUNK_GENERAL_TERMS=--accept-sgt-current-at-splunk-com -e SPLUNK_PASSWORD=changeme -e SPLUNK_APPS_URL="/mnt/resources/sankey-diagram-custom-visualization_130.tgz" -p 8000:8000 -p 8089:8089 -v ./artifacts:/mnt/artifacts -v ./resources:/mnt/resources splunk4dfir:latest start

See also

NetworkMiner

Freemium

Network forensics analysis tool (NFAT) that captures packets and parses them to reconstruct transmit…

LockKnife

Open Source

LockKnife: The Ultimate Android Security Research Tool. A unified TUI workspace and headless CLI for…

incident-response-plan-template

Free

A concise, directive, specific, flexible, and free incident response plan template…

SingleFileExtractor

Open Source

A tool for extracting contents (assemblies, configuration, etc.) from a single-file application to a…

aparoid

Free

Static and dynamic Android application security analysis…

volatility3

Free

Volatility is the world's most widely used framework for extracting digital artifacts from volatile …